On Thu, Oct 29, 2026 at 08:32:31PM +0000, Steve McIntyre wrote:
> On Thu, Oct 29, 2026 at 09:24:11PM +0100, Pascal Hambourg wrote:
> >[bug mail address fixed]
D'oh! Thanks :)
> >Do you see any case where it might be complicated, inconvenient or impossible
> >to preseed the copying of custom CA certificates ?
Yes. I tested without the copying code in bootstrap-base.postinst:
(a) an https mirror with a certificate signed by a CA included in
ca-certificates. Install completed fine.
(b) an https mirror that needs a custom CA. This worked for
install_base_system but failed in apt_update. It turns copying *is*
required in this case and doing it in late_command is too late.
The reason my preseeding setup worked was precisely because of the
copying - not because of my late_command as I thought.
> >If yes, an option would be for bootstrap-base.postinst to not copy
> >certificates which are provided by ca-certificates-udeb. I guess it would
> >require to ship a list of these certificates or their hashes, either provided
> >by ca-certificates-udeb or generated when building the d-i image.
>
> Couldn't we just copy those then clear them out as part of the
> post-installation step? Wouldn't that be an easy fix?
How would we identify the certs to be cleared out though? This seems
non-trivial and potentially error prone - or am I just not seeing the
easy solution?
What if we instead mirror what ca-certificates does and require any
custom CA certificates to be in /usr/local/share/ca-certificates in the
installer and then copy that into /target?
Getting the custom certificate into the installer already requires
creating the hash symlink in /etc/ssl/certs manually for lack of openssl
rehash / c_rehash:
d-i preseed/early_command string \
somehow_create /etc/ssl/certs/XXX.crt; \
ln -s /etc/ssl/certs/XXX.crt /etc/ssl/certs/HHHHHHHH.0;
Or building the hash symlink into the image itself along with the
certificate. That would be no more difficult if we required the certs to
be in /usr/local/share/ca-certificates:
d-i preseed/early_command string \
somehow_create /usr/local/share/ca-certificates/XXX.crt; \
ln -s /usr/local/share/ca-certificates/XXX.crt /etc/ssl/certs/HHHHHHHH.0;
Thoughts?
Best regards,
Max
